PT-2026-52307 · Linux · Linux

Published 2026-06-25 · Updated 2026-06-25 · CVE-2026-53212

Mitre

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft tunnel: fix use-after-free on object destroy

nft tunnel obj destroy() calls metadata dst free() which directly kfree()s the metadata dst, ignoring the dst entry refcount. Packets that took a reference via dst hold() in nft tunnel obj eval() and are still queued (e.g. in a netem qdisc) are left with a dangling pointer. When these packets are eventually dequeued, dst release() operates on freed memory.

Replace metadata dst free() with dst release() so the metadata dst is freed only after all references are dropped. The dst subsystem already handles metadata dst cleanup in dst destroy() when DST METADATA is set.

Related Identifiers

CVE-2026-53212

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-53212 · Security Note
• https://git.kernel.org/stable/c/5e9ee18b27fde88cb6148202b33916c66693fe82 · Note
• https://git.kernel.org/stable/c/55b79b1ae42372012413ce0413181d26679b17ef · Note
• https://git.kernel.org/stable/c/fda6573a46ad24f35348e024905ee5bdf729797e · Note
• https://git.kernel.org/stable/c/941d7394efda5e054e2d6f3e0dd0f6a9ba19aaa3 · Note
• https://git.kernel.org/stable/c/8767fe4079affa74314d7eb3220e700150289842 · Note
• https://git.kernel.org/stable/c/c32b26aaa2f9216520a38b3f4bfeec846eb3eb8a · Note
• https://git.kernel.org/stable/c/349df61526d2e39decc685d246202e3e284cfe05 · Note
• https://git.kernel.org/stable/c/f9a0e4b61054cde89a2a77845293c726cc07cc43 · Note